PatchTheCEVCVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
CVE-2026-76504 is a critical-severity flaw (CVSS 9.8) affecting catalyst sd-wan manager, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this
Why this priority
- Critical severity
- Exploited in the wild (CISA KEV)
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.8% (top 21%) |
| CISA exploited list | Yes, fix due 2026-10-03 |
| Weakness | CWE-177 |
| Published | 2026-09-30 |
| Last modified | 2026-10-03 |
Am I affected?
Timeline
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Published CVE record published
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
Exact fixes by distribution
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: ShadowForge-Cyber/CVE-2026-76504-Proof-of-concept (2 stars)
- GitHub PoC: pastelghost3/cve-2026-76504-nuclei (0 stars)
Advisories and coverage
Official advisories
- Cisco Security Advisories: Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability 2026-10-02
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.